Changes Scan Docs Trust

← All changes

When upstream breaks, Teire fixes your code.

teire-dev/teire System status

Built on

Product

Scan a repo Changes Install on GitHub Dashboard Demo video

Developers

Docs GitHub CLI and MCP teire.yml schema npm

Trust

How Teire runs Source code

vite (npm) · Teire

Changes Scan Docs Trust

vite

npm

latest 8.3.5 · 2026-10-21www.npmjs.com · all 762 versions

Security advisories23

vite: Vite has an `server.fs.deny` bypass with an invalid `request-target`fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, 4.5.13
vite: Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryfixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, 4.5.11
vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handlingfixed in 8.0.5, 7.3.2, 6.4.2
vite: launch-editor: `fs.existsSync()` existence check can be bypassed on Windowsfixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4

Versions that change something

6.4.42026-10fixes 5 advisories
7.0.72025-09fixes 2 advisories
7.0.82025-10fixes 1 advisory
7.1.52025-09fixes 2 advisories

What each upgrade changes in its API

Changes argument countsbreaks on upgrade→ 8.3.5· 2
Removes import pathsbreaks on upgrade→ 8.3.5· 1
Changes typesbreaks on upgrade→ 8.3.5· 104
Deprecates APIs

vite: Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

fixed in 5.4.6, 5.3.6, 5.2.14, 4.5.4, 3.2.11, 5.1.8

vite: launch-editor: escapeCmdArgs() omits % escaping on Windowsfixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4

vite: Vite's server.fs.deny bypassed with /. for files under project rootfixed in 6.3.4, 6.2.7, 6.1.6, 5.4.19, 4.5.14

vite: vite allows server.fs.deny bypass via backslash on Windowsfixed in 7.1.11, 7.0.8, 6.4.1, 5.4.21

vite: Vite's `server.fs.deny` is bypassed when using `?import&raw`fixed in 5.4.6, 5.3.6, 5.2.14, 4.5.4, 3.2.11, 5.1.8

vite: Vite: Cross origin script execution through Vite custom middlewarefixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4

vite: launch-editor vulnerable to command injection via the crafted request on Windowsfixed in 5.4.9

vite: vite: `server.fs.deny` bypass on Windows alternate pathsfixed in 8.0.16, 7.3.5, 6.4.3

vite: Vite middleware may serve files starting with the same name with the public directoryfixed in 7.1.5, 7.0.7, 6.3.6, 5.4.20

vite: Vite's `server.fs` settings were not applied to HTML filesfixed in 7.1.5, 7.0.7, 6.3.6, 5.4.20

vite: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocketfixed in 8.0.5, 7.3.2, 6.4.2

vite: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsfixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4

vite: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machinefixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4

vite: Vite: `server.fs.deny` bypassed with queriesfixed in 8.0.5, 7.3.2

vite: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windowsfixed in 8.0.16, 7.3.5, 6.4.3

vite: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`fixed in 8.3.3, 8.2.4

vite: Websites were able to send any requests to the development server and read the response in vitefixed in 6.0.9, 5.4.12, 4.5.6

vite: Vite bypasses server.fs.deny when using ?raw??fixed in 6.2.3, 6.1.2, 6.0.12, 5.4.15, 4.5.10

vite: Vite allows server.fs.deny to be bypassed with .svg or relative pathsfixed in 6.2.5, 6.1.4, 6.0.14, 5.4.17, 4.5.12

7.1.11

2025-10

fixes 1 advisory

7.3.22026-04fixes 3 advisories

7.3.52026-06fixes 2 advisories

7.3.72026-10fixes 5 advisories

8.0.52026-04fixes 3 advisories

8.0.162026-06fixes 2 advisories

8.1.62026-10fixes 5 advisories

8.2.42026-10fixes 6 advisories

8.3.32026-10fixes 6 advisories

8.3.5latest2026-105 changes5 breaking

●breaks on upgrade

Removes APIs●breaks on upgrade→ 8.3.5· 79